Business Criticality on Business Application vs Business Criticality of Application Service

[Caleb Cordes]

I need a sanity check here. The choices for the Business Criticality field on Business Application do not match the choices on Application Service (inherited from cmdb_ci_service).

I have always thought this was a disappointing and annoying user experience for anyone trying to use the CSDM and APM. My plan on fixing this aims to update the UX, while not impacting OOTB functionality. 

1. Align the number of choices, by adding "Critical" choice to the cmdb_ci_business_app.business_criticality field. Update the sequences of all choices to place "Critical" above "High."
2. Algin the LABELS by updating the labels (values are not touched) for cmdb_ci_service.business_criticality (dictionary for Application Service's "Business Criticality" field) field to match the labels on cmdb_ci_business_app.business_criticality. 

My question for the APM community:  The only thing I’m adding that the system won’t be accounting for is the “Critical” choice on the Business Applications "Business Criticality" field in step 1. I believe this new choice would only impact APM (please correct me if I'm wrong). Has anyone done this before and can share some feedback or lessons learned?

[Mathew Hillyard]

Hi @Caleb Cordes 

There could possibly be a case for the production instance (Application Service) of a Business Application having the same business criticality as it's Business Application, but it's less likely any of the other Application Services have the same level of criticality given they're not used for production. In addition, an Application Service's criticality could depend on whether it supports any other Application Services - although it's recommended to use Digital Integration Management to define data interfaces and APIs at the Business App level instead of large numbers of parent-child Application Services.

As @Cheshire Cat mentions, the criticality to your business of a particular design object (Business App) may be treated differently for reporting purposes to the operational criticality of a stack of technology (App Service) that underpins one or more Service Offerings.

I hope this helps!

Mat

[StephanieLP]

Hi @Caleb Cordes ,

I have exactly the same requirement. Curious if you went through with it, what the impact was and if you would recommend it?

Thanks much!
Stephanie

[dimi_]

BA criticality is typically driven by high-level risk assessments, and the enabled business processes. On the other hand, app service criticality focuses on operational availability, incident impact, and the infrastructure dependencies.

I believe it is not ideal to try and sync these values. In fact, they should be different. For example, consider a low-criticality BA like a legacy internal tool used for reporting or archiving. While the application itself is low risk, it might rely on an app service that shares a database cluster with a critical production service.

If that database goes down, the low-criticality app is impacted just as severely as the high-criticality one. Therefore, the app service needs its own distinct criticality tier to trigger the appropriate incident response, regardless of the 'business domain' criticality assigned to the parent Application.